littlefs through 2.11.3 Type Confusion in lfs_dir_traverse via lfs_migrate

Advisories

littlefs through 2.11.3 Type Confusion in lfs_dir_traverse via lfs_migrate

Severity: medium
Date: 11/15/2026
Affecting: littlefs <= 2.11.3
CVE: CVE-2026-129490
CWE: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
CVSS: 6.8
CVSS V4 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References: https://github.com/littlefs-project/littlefs/issues/1213
https://github.com/littlefs-project/littlefs/blob/v2.11.3/lfs.c#L1056-L1063
https://github.com/sigdevel/pocs/blob/main/res/littlefs/1/1_lfs_dir_traverse_lfs_c_1059.img
Credit: Alexander A. Shvedov (sigdevel)
Description: littlefs through 2.11.3, when built with LFS_MIGRATE, contains a type confusion vulnerability in lfs_dir_traverse() that treats a stack lfs_diskoff struct as an lfs_attr array. Attackers can supply a crafted littlefs v1 image whose metadata is read as LFS_FROM_USERATTRS during migration, causing out-of-bounds stack reads and process crashes.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo